The vulnerability identified as CVE-2026-57709 involves improper limitation of a pathname to a restricted directory (path traversal) in the WP Swings Membership For WooCommerce plugin. This flaw allows an unauthenticated attacker to potentially access or manipulate files outside the intended directory scope. The affected versions include all versions up to and including 3.1.0. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with availability impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability can lead to availability impact by allowing attackers to traverse directories and potentially disrupt the normal operation of the plugin or the hosting environment. There is no reported confidentiality or integrity impact. The attack can be performed remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from WP Swings and consider restricting access to the plugin files or applying temporary access controls to mitigate exploitation risk.